fix(auth): pass request.headers to getCurrentUser in all protected routes

dashboard, diagnoses, expert routes now support Authorization header fallback for Android WebView

Co-Authored-By: Claude <noreply@anthropic.com>

apps/api/src/routes/dashboard.ts

@@ -13,7 +13,7 @@ export const dashboardRoutes = new Elysia({ prefix: '/api/v1' })
   .get('/dashboard/summary', async ({ request }) => {
     try {
       const db = createDbClient();
-      const user = await getCurrentUser(request.headers.get('cookie'));
+      const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
 
       const diseases = await db.select().from(diseaseCatalog).orderBy(diseaseCatalog.displayOrder);
       const manualRows = await db.select().from(manualClassifications).orderBy(desc(manualClassifications.createdAt)).limit(1);

apps/api/src/routes/diagnoses.ts

@@ -175,7 +175,7 @@ function getFileFromBody(body: unknown): File | null {
 
 export const diagnosisRoutes = new Elysia({ prefix: '/api/v1' })
   .post('/diagnoses', async ({ body, request }) => {
-    const user = await getCurrentUser(request.headers.get('cookie'));
+    const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
     if (!user) return unauthorized('Authentication required');
 
     const file = getFileFromBody(body);
@@ -251,7 +251,7 @@ export const diagnosisRoutes = new Elysia({ prefix: '/api/v1' })
     }
   })
   .get('/diagnoses', async ({ request }) => {
-    const user = await getCurrentUser(request.headers.get('cookie'));
+    const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
     if (!user) return unauthorized('Authentication required');
 
     try {
@@ -270,7 +270,7 @@ export const diagnosisRoutes = new Elysia({ prefix: '/api/v1' })
     }
   })
   .get('/diagnoses/:id', async ({ params, request }) => {
-    const user = await getCurrentUser(request.headers.get('cookie'));
+    const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
     if (!user) return unauthorized('Authentication required');
 
     try {

apps/api/src/routes/expert.ts

@@ -16,7 +16,7 @@ function isDiagnosisRecordOrNull(record: unknown): record is DiagnosisRecord {
 
 export const expertRoutes = new Elysia({ prefix: '/api/v1/expert' })
   .get('/reviews', async ({ request }) => {
-    const user = await getCurrentUser(request.headers.get('cookie'));
+    const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
     if (!user) return unauthorized('Authentication required');
     if (user.role !== 'expert') return forbidden('Expert role required');
 
@@ -36,7 +36,7 @@ export const expertRoutes = new Elysia({ prefix: '/api/v1/expert' })
     }
   })
   .post('/reviews/:diagnosisId', async ({ params, body, request }) => {
-    const user = await getCurrentUser(request.headers.get('cookie'));
+    const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
     if (!user) return unauthorized('Authentication required');
     if (user.role !== 'expert') return forbidden('Expert role required');